2dcacbf869f68fb634f21f26f0d73f35f8d47a6f5c7c0281d6ccdce81ed87e49

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 16:22

Target

NEAS.d9da09e4edd4e03659e0beaddc841d80_JC.dll
Size

47KB
MD5

d9da09e4edd4e03659e0beaddc841d80
SHA1

d52487741a08cd15ddf76adc1aa10f7f052031e0
SHA256

2dcacbf869f68fb634f21f26f0d73f35f8d47a6f5c7c0281d6ccdce81ed87e49
SHA512

478ea7d43158de01e39c0558072cd4af296690c8309f41f16e4cde9f2271d7bc5c64271a4ed9b2ea7df1f5aa1e2c0e36295ef905c50a8d75d7ffeedcff13bf80
SSDEEP

384:mOJHojdGBfNyb8E9VF6IYinAM+oP91CojQcMI2IYiF94vAM+o/8E9VF0Nyq37:m3WjEpYinAMxJ9BYi+AMxkEC7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28
PID 2816 wrote to memory of 2756	2816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d9da09e4edd4e03659e0beaddc841d80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d9da09e4edd4e03659e0beaddc841d80_JC.dll,#1
  2⤵
  PID:2756